CVE-2016-6582
Doorkeeper is vulnerable to replay attacks
CVE-2016-6582 is a critical vulnerability (CVSS 9.1) in Doorkeeper Project Doorkeeper, published January 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.81%, the 91st percentile. Fixed in doorkeeper 4.2.0.
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
CVE-2016-6582- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE List No score
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
CVE-2016-6582- Updated
- 2026-11-02
EUVDEUVD-2017-0157 No score
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
EUVD-2017-0157- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3m6r-39p3-jq25
Doorkeeper is vulnerable to replay attacks
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
GHSA-3m6r-39p3-jq25- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1254
- Updated
- 2026-11-02
OSV
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
CVE-2016-6582- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6582
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
DEBIAN-CVE-2016-6582- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3m6r-39p3-jq25
Doorkeeper is vulnerable to replay attacks
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
GHSA-3m6r-39p3-jq25- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1254
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-6582
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- Record
UBUNTU-CVE-2016-6582- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVUSN-7394-1 No score
ruby-doorkeeper vulnerabilities
Jonathan Clem and Justin Bull discovered that Doorkeeper could allow arbitrary token revocation and replay attacks. An attacker could possibly use this issue to gain unauthorized access to a system. (CVE-2016-6582)
It was discovered that Doorkeeper incorrectly handled storing client names. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2018-1000088)
- Record
USN-7394-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
doorkeeperRubyGems |
before 4.2.0 | 4.2.0 |
ruby-doorkeeperDebian:12 |
before 4.2.0-3 | 4.2.0-3 |
ruby-doorkeeperDebian:13 |
before 4.2.0-3 | 4.2.0-3 |
ruby-doorkeeperDebian:14 |
before 4.2.0-3 | 4.2.0-3 |
doorkeeperRubyGems |
before 4.2.0, plus listed versions 0.1.00.1.10.2.00.3.00.3.1 Show 45 moreShow less0.3.20.3.30.3.40.4.00.4.10.4.20.5.00.5.0.rc10.6.00.6.0.rc10.6.10.6.20.6.30.6.40.6.50.6.60.6.70.7.00.7.10.7.20.7.30.7.41.0.01.0.0.rc11.0.0.rc21.1.01.2.01.3.01.3.11.4.01.4.11.4.22.0.02.0.0.alpha12.0.0.rc22.0.0.rc32.0.12.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.2 |
4.2.0 |
ruby-doorkeeperUbuntu:Pro:16.04:LTS |
before 2.2.1-1ubuntu0.1~esm2, plus listed versions 2.2.1-12.2.1-1ubuntu0.1~esm1 |
2.2.1-1ubuntu0.1~esm2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/92551
packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html
seclists.org/fulldisclosure/2016/Aug/105
github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-6582
web.archive.org/web/20170214021758/http://www.securityfocus.com/bid/92551
openwall.com/lists/oss-security/2016/08/19/2
security-tracker.debian.org/tracker/CVE-2016-6582
ubuntu.com/security/CVE-2016-6582
cve.org/CVERecord?id=CVE-2016-6582
Left out here: 11 versions. The JSON record has them.